Hi Richard,
Yes you can do that, if is CRM 4, you just need to distinguish the internal IP subnet from the external. ADFS will require more configuration but is also possible.
If you have CRM 2011 the following link provides you lots of information on this:
http://www.microsoft.com/en-us/download/details.aspx?id=3621
Hope it helps
Visit my blog for CRM material, improving performance, kerberos, IFD, development tips, etc. :) http://quantusdynamics.blogspot.com